CVE-2025-61594CWE-200CWE-212

URI Credential Leakage Bypass over CVE-2025-27221

Low · published December 30, 2025

CVSS v4.0
2.1
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00560 · 45.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer
Published
2025-12-30T21:03Z
EPSS history
Timeline
  • 30 DEC 21:03Z
    URI Credential Leakage Bypass over CVE-2025-27221
    cvelistv5